AWSCloudTrail - SAML update identity provider

Status: available
Severity: high
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Detects updates to AWS SAML identity provider configuration. Unauthorized changes can allow adversaries to issue trusted federation tokens and gain persistent or privileged access.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `UpdateSAMLProvider`: Updates the metadata document for an existing SAML provider in IAM.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS SAML Update identity provider (Splunk)
AWS SAML Update identity provider (Splunk)

Rule body

id: bce1dcba-4948-414d-8838-6385afb9d496
name: AWSCloudTrail - SAML update identity provider
description: |
  Detects updates to AWS SAML identity provider configuration. Unauthorized changes can allow adversaries to
  issue trusted federation tokens and gain persistent or privileged access.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1078
query: |
    AWSCloudTrail
    | where EventName == "UpdateSAMLProvider" and isempty(ErrorCode) and isempty(ErrorMessage)
    | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
    | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
    | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
    | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
      AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  EventSource: EventSource
  AWSRegion: AWSRegion
  UserIdentityArn: UserIdentityArn
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS SAML identity provider updated by {{AccountName}}'
  alertDescriptionFormat: 'Detected UpdateSAMLProvider from {{SourceIpAddress}} in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName == "UpdateSAMLProvider" and isempty(ErrorCode) and isempty(ErrorMessage)

Stage 3: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	eq	`UpdateSAMLProvider`	`field:"aws::eventName" kind:eq value:"UpdateSAMLProvider"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`UserIdentityArn`	`extend`
`UserName`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`